Tag Info

Hot answers tagged

30

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


13

These are academic distinctions. In the real world, you will find some combination of all of these concepts going by different terms. In some organizations, a DMZ has a separate ISP network connection and has no access to internal resources. In other organizations, there are domain-joined machines in the DMZ that can communicate to a restricted set of ...


8

As @ChristopherPerrin said, it's the background noise of the internet. Scripts and bots are constantly scanning the internet, doing the equivalent of jiggling door handles looking for ones that are unlocked or poorly locked. I do however disagree that there is nothing you can do about it. Use those logs to block them at the firewall level. On linux I use ...


8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


7

Depends on what you're comfortable doing; when starting to "professionalize" our office network for a similarly sized business, I set up a pfSense Firewall behind our modem, and assigned it routing tasks for the office. All you need is a machine to dedicate with a few NICs and you're on your way. It's pretty well documented online, and I haven't had an ...


7

I don't think I've recently heard of an extranet outside of textbooks and class rooms. A DMZ is a common networking topology with a network segment that is segregated by firewalls from the internal network and untrusted external networks (aka the internet). In contrast the Extranet, if it is actually included in the network design, implies somewhat that ...


5

I think it's actually more debated than you make it appear. There is an admittedly old, related Linux FAQ: http://www.tldp.org/HOWTO/VPN-HOWTO/ I've used a PPP-over-ssh-over-ADSL for more than 12 years, and it never failed me, so from my experience I'd dare to say that the doomsayers probably largely exaggerate. TCP over TCP is probably a bad idea with RTC ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


5

What you don't want is a VPN. What you do want is indeed IPsec, but not in tunnel mode. Rather, you want IPsec in transport mode. In this configuration, each host communicates directly to its peer, and only packet payloads are encrypted, leaving IP headers in place. This way, you don't need to do any routing gymnastics to get things working. Yes, you'll ...


5

According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel. And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s. So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so ...


5

Reverse DNS points an IP to a domain name. An ISP/Hosting company should own the IP range, and it should be no problem at all for them to create a reverse DNS entry for your IP, unless it's not just your IP (you're on shared hosting). Should that be the case, you are not going to get anywhere. Your ISP/Hosting probably can get you your own individual IP, ...


5

I've heard the great firewall used to redirect "blocked" traffic to a handful of phony IPs, but this was causing their blocks to be easily spotted (I'm not sure if it allowed easy subversion). In any case the administrators have started redirecting to random IPs. This has led to some Chinese users getting porn, instead of facebook or vpns, apparently. I ...


4

With a Cisco AnyConnect VPN there is an option on the client side to allow this IF the VPN admin is allowing split-tunneling. You can see the option here: As far as on the firewall itself, if you are the VPN/firewall admin (I'm guessing you aren't) then the setting is similar to this here:


4

How can I find out what DNS server those customers are using ? Contact Chinanet and ask? Seriously, DNS is configurable on the client side. Most people get DNS settings via DHCP, but OpenDNS and Google's DNS offering wouldn't have a business model if you couldn't change them. Is there anyway to determine if an HTTP request is coming from a VPN ? ...


4

Use a dynamic DNS service. Get a hostname for each site. configure VPN connections to use hostname for each connection instead of the sites IP address (Since you said its dynamic and subject to change) The dynamic DNS service should come with an application that monitors for an IP address change, and updates the hostname record automatically.


4

yes you can do this with bind views: http://www.zytrax.com/books/dns/ch7/view.html basically, you define each view as a subnet, and then each view maintains its own zone file. depending on the source ip/subnet of the dns query, you will get a different "view". this is common for name servers to use in an "internal"/"external" views, so as dns ...


4

Yes, UDP over a VPN is possible, but no, that wouldn't change a thing. Although the underlying transport may be reliable, the UDP has been designed not to retransmit lost packets. If you really have a problem with packetloss, either switch to TCP for transport, fix it by making the application send UDP packets slower, or increase the bandwidth on the path ...


4

Network browsing across VPNs has always been problematic in my experience. If I were you I'd use a WINS server to get browsing to work (in an even remotely reliable manner). Other methods may well work, but deploying WINS is pretty straightforward and easy and, in my experience, has done the job.


4

Setting up a VPN can be pretty easy, many routers have some built-in VPN functionality already. VPN is a broad topic and we don't know what your needs and constraints are, because you didn't tell us. You should probably hire a consultant to help you get it set up and find out what your needs and constraints are; this shouldn't be a service that you pay for ...


3

It is normal that unknown users try to connect with standard usernames. You can view it as the noise of the internet. If you have strong passwords there is no need to worry. Take it as it is and keep your software updated. There is about nothing you can do.


3

Cisco ASA firewalls all support SSL VPN. Depending on the edition and version of the firewall (Cisco ASA 5505, 5510, 5520, etc.), there's a limit to the number of simultaneous SSL VPN users that can connect. Please see this Cisco licensing reference guide. Please find out which version of Cisco ASA firewall you have. RAM for Cisco firewalls is ...


3

How I "clear" the entries created? OpenVPN Stores this in the persist file. You can set this file by using the ifconfig-pool-persist option. If you don't set it then many distros will automatically add one at some logical location under var. Anyway, find your persist file, or manually specify one in your configuration. Once you know where it is, ...


3

It's an IPV6 issue, if you go to console and open your ppp log you will notice an IPv6 query every 3 seconds until it times out. You need to tell the ppp daemon to not try IPv6. To do this create a text file called options.txt with the following string: ipv6cp-max-configure 0 Save that file to the etc/ppp directory. You need to be root or sudo cp it via ...


3

update your azure powershell installation. its a new cmdlet.


3

Communications between your machine and the VPN endpoint are encrypted. That includes the VNC connection. However, once the packets reach the remote network, the VNC communications between the servers and the VPN endpoint are not encrypted. TightVNC only encrypts passwords, not traffic (as per http://www.tightvnc.com/faq.php).


3

The kind of fallback behavior you seem to expect is not part of how DNS is supposed to work. The second nameserver in resolv.conf should only be contacted in the event that the first does not respond or there is some other sort of network error. Microsoft have apparently done their own thing, and it certainly is useful for what you are trying to do, but it ...


3

Despite being an old question I stumbled here and I can see a lot of speculation here. The other answers are likely correct to some extent, but I believe it misses the crucial factor for the situation experienced by the asker. VPN uses compression. I'm using LZO-compression and that will improve my speeds up to 4x compared to the connection width. This is ...


3

What about putting it in bridged mode, and using your own router to see if the problem still happens. My guess some kind of problem in the routing side of things, persistent NAT? Anyway, just about no one that I know uses carrier provided gear, mainly for security and manageability concerns. Even if you get something else, you should consider something ...


3

It sounds like the printer isn't configured with a default gateway. In that scenario your ping requests from "Network A" will travel to "Network B" to the printer. The printer, having no default gateway configured, won't be able to respond back to "Network B" because, without a default gateway configured, it has no ability to send packets to subnets other ...



Only top voted, non community-wiki answers of a minimum length are eligible